← All changes | lib/admin/groups-admin-capabilities-edit.php +55 -48 1.11.3 → 4.7.0 View file →

		@@ -24,89 +24,94 @@
24	24	}
25	25
26	26	/**
27	27	* Show edit capability form.
	28	+ *
28	29	* @param int $capability_id capability id
29	30	*/
30	31	function groups_admin_capabilities_edit( $capability_id ) {
31	32
32		- global $wpdb;
33		-
34		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
35		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	33	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	34	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
36	35	}
37	36
38	37	$capability = Groups_Capability::read( intval( $capability_id ) );
39	38
40		- if ( empty( $capability ) ) {
41		- wp_die( __( 'No such capability.', GROUPS_PLUGIN_DOMAIN ) );
	39	+ if ( empty( $capability ) ) { // @phpstan-ignore empty.variable
	40	+ wp_die( esc_html__( 'No such capability.', 'groups' ) );
42	41	}
43	42
44		- $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	43	+ $current_url = groups_get_current_url();
45	44	$current_url = remove_query_arg( 'action', $current_url );
46	45	$current_url = remove_query_arg( 'capability_id', $current_url );
47	46
48		- $capability_capability = isset( $_POST['capability-field'] ) ? $_POST['capability-field'] : $capability->capability;
49		- $description = isset( $_POST['description-field'] ) ? $_POST['description-field'] : $capability->description;
	47	+ $capability_capability = isset( $_POST['capability-field'] ) ? sanitize_text_field( $_POST['capability-field'] ) : ( $capability->capability !== null ? $capability->capability : '' ); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	48	+ $description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ( $capability->description !==null ? $capability->description : '' ); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
50	49
51	50	$capability_readonly = ( $capability->capability !== Groups_Post_Access::READ_POST_CAPABILITY ) ? "" : ' readonly="readonly" ';
52	51
53		- $output =
54		- '<div class="manage-capabilities wrap">' .
55		- '<h1>' .
56		- __( 'Edit a capability', GROUPS_PLUGIN_DOMAIN ) .
57		- '</h1>' .
	52	+ $output = '<div class="manage-capabilities wrap">';
	53	+ $output .= '<h1>';
	54	+ $output .= esc_html__( 'Edit a capability', 'groups' );
	55	+ $output .= '</h1>';
58	56
59		- Groups_Admin::render_messages() .
	57	+ $output .= Groups_Admin::render_messages();
60	58
61		- '<form id="edit-capability" action="' . esc_url( $current_url ) . '" method="post">' .
62		- '<div class="capability edit">' .
63		- '<input id="capability-id-field" name="capability-id-field" type="hidden" value="' . esc_attr( intval( $capability_id ) ) . '"/>' .
	59	+ $output .= sprintf( '<form id="edit-capability" action="%s" method="post">', esc_url( $current_url ) );
	60	+ $output .= '<div class="capability edit">';
	61	+ $output .= sprintf( '<input id="capability-id-field" name="capability-id-field" type="hidden" value="%s"/>', esc_attr( intval( $capability_id ) ) );
64	62
65		- '<div class="field">' .
66		- '<label for="capability-field" class="field-label first required">' .__( 'Capability', GROUPS_PLUGIN_DOMAIN ) . '</label>' .
67		- '<input ' . $capability_readonly . ' id="capability-field" name="capability-field" class="capability-field" type="text" value="' . esc_attr( stripslashes( $capability_capability ) ) . '"/>' .
68		- '</div>' .
	63	+ $output .= '<div class="field">';
	64	+ $output .= sprintf( '<label for="capability-field" class="field-label first required">%s</label>', esc_html__( 'Capability', 'groups' ) );
	65	+ $output .= sprintf(
	66	+ '<input %s id="capability-field" name="capability-field" class="capability-field" type="text" value="%s"/>',
	67	+ $capability_readonly,
	68	+ esc_attr( stripslashes( $capability_capability ) )
	69	+ );
	70	+ $output .= '</div>';
69	71
70		- '<div class="field">' .
71		- '<label for="description-field" class="field-label description-field">' .__( 'Description', GROUPS_PLUGIN_DOMAIN ) . '</label>' .
72		- '<textarea id="description-field" name="description-field" rows="5" cols="45">' . stripslashes( wp_filter_nohtml_kses( $description ) ) . '</textarea>' .
73		- '</div>' .
	72	+ $output .= '<div class="field">';
	73	+ $output .= sprintf( '<label for="description-field" class="field-label description-field">%s</label>', esc_html__( 'Description', 'groups' ) );
	74	+ $output .= sprintf( '<textarea id="description-field" name="description-field" rows="5" cols="45">%s</textarea>', stripslashes( wp_filter_nohtml_kses( $description ) ) );
	75	+ $output .= '</div>';
74	76
75		- '<div class="field">' .
76		- wp_nonce_field( 'capabilities-edit', GROUPS_ADMIN_GROUPS_NONCE, true, false ) .
77		- '<input class="button button-primary" type="submit" value="' . __( 'Save', GROUPS_PLUGIN_DOMAIN ) . '"/>' .
78		- '<input type="hidden" value="edit" name="action"/>' .
79		- '<a class="cancel button" href="' . esc_url( $current_url ) . '">' . __( 'Cancel', GROUPS_PLUGIN_DOMAIN ) . '</a>' .
80		- '</div>' .
81		- '</div>' . // .capability.edit
82		- '</form>' .
83		- '</div>'; // .manage-capabilities
	77	+ $output .= '<div class="field">';
	78	+ $output .= wp_nonce_field( 'capabilities-edit', GROUPS_ADMIN_GROUPS_NONCE, true, false );
	79	+ $output .= sprintf( '<input class="button button-primary" type="submit" value="%s"/>', esc_attr__( 'Save', 'groups' ) );
	80	+ $output .= '<input type="hidden" value="edit" name="action"/>';
	81	+ $output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
	82	+ $output .= '</div>';
	83	+ $output .= '</div>'; // .capability.edit
	84	+ $output .= '</form>';
	85	+ $output .= '</div>'; // .manage-capabilities
84	86
85		- echo $output;
	87	+ echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
86	88	} // function groups_admin_capabilities_edit
87	89
88	90	/**
89	91	* Handle edit form submission.
	92	+ *
	93	+ * @return int|boolean the capability ID if it was updated, otherwise false
90	94	*/
91	95	function groups_admin_capabilities_edit_submit() {
92	96
93	97	$result = false;
94	98
95		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
96		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	99	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	100	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
97	101	}
98	102
99		- if ( !wp_verify_nonce( $_POST[GROUPS_ADMIN_GROUPS_NONCE], 'capabilities-edit' ) ) {
100		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	103	+ if ( !groups_verify_post_nonce( GROUPS_ADMIN_GROUPS_NONCE, 'capabilities-edit' ) ) {
	104	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
101	105	}
102	106
103		- $capability_id = isset( $_POST['capability-id-field'] ) ? $_POST['capability-id-field'] : null;
	107	+ $capability_id = groups_sanitize_post( 'capability-id-field' );
104	108	$capability = Groups_Capability::read( $capability_id );
105	109	if ( $capability ) {
106		- $capability_id = $capability->capability_id;
107		- if ( $capability->capability !== Groups_Post_Access::READ_POST_CAPABILITY ) {
108		- $capability_field = isset( $_POST['capability-field'] ) ? $_POST['capability-field'] : null;
	110	+ $capability = new Groups_Capability( $capability_id );
	111	+ $capability_id = $capability->get_capability_id();
	112	+ if ( $capability->get_capability() !== Groups_Post_Access::READ_POST_CAPABILITY ) {
	113	+ $capability_field = isset( $_POST['capability-field'] ) ? sanitize_text_field( $_POST['capability-field'] ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
109	114	} else {
110	115	$capability_field = Groups_Post_Access::READ_POST_CAPABILITY;
111	116	}
112	117	if ( !empty( $capability_field ) ) {
		@@ -112,23 +117,25 @@
112	117	if ( !empty( $capability_field ) ) {
113	118	$update = true;
114	119	if ( $other_capability = Groups_Capability::read_by_capability( $capability_field ) ) {
115	120	if ( $other_capability->capability_id != $capability_id ) {
116		- Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> capability already exists and cannot be assigned to this one.', GROUPS_PLUGIN_DOMAIN ), stripslashes( wp_filter_nohtml_kses( $other_capability->capability ) ) ), 'error' );
	121	+ /* translators: capability name */
	122	+ Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> capability already exists and cannot be assigned to this one.', 'groups' ), stripslashes( wp_filter_nohtml_kses( $other_capability->capability ) ) ), 'error' );
117	123	$update = false;
118	124	}
119	125	}
120	126	if ( $update ) {
121		- $description = isset( $_POST['description-field'] ) ? $_POST['description-field'] : '';
	127	+ $description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
122	128	$capability_id = Groups_Capability::update( array( 'capability_id' => $capability_id, 'capability' => $capability_field, 'description' => $description ) );
123	129	if ( $capability_id ) {
124	130	$result = $capability_id;
125	131	} else {
126		- Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> capability could not be updated.', GROUPS_PLUGIN_DOMAIN ), stripslashes( wp_filter_nohtml_kses( $capability ) ) ), 'error' );
	132	+ /* translators: capability name */
	133	+ Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> capability could not be updated.', 'groups' ), stripslashes( wp_filter_nohtml_kses( $capability->get_capability() ) ) ), 'error' );
127	134	}
128	135	}
129	136	} else {
130		- Groups_Admin::add_message( __( 'The <em>Capability</em> must not be empty.', GROUPS_PLUGIN_DOMAIN ), 'error' );
	137	+ Groups_Admin::add_message( __( 'The <em>Capability</em> must not be empty.', 'groups' ), 'error' );
131	138	}
132	139	}
133	140	return $result;
134	141	} // function groups_admin_capabilities_edit_submit